GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47433 (GCVE-0-2021-47433)

Vulnerability from cvelistv5 – Published: 2024-05-22 06:19 – Updated: 2026-08-05 08:47
VLAI
Title
btrfs: fix abort logic in btrfs_replace_file_extents
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix abort logic in btrfs_replace_file_extents Error injection testing uncovered a case where we'd end up with a corrupt file system with a missing extent in the middle of a file. This occurs because the if statement to decide if we should abort is wrong. The only way we would abort in this case is if we got a ret != -EOPNOTSUPP and we called from the file clone code. However the prealloc code uses this path too. Instead we need to abort if there is an error, and the only error we _don't_ abort on is -EOPNOTSUPP and only if we came from the clone file code.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-10 18:56 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8fccebfa534c7984864394fa03608305e4929aae , < 0e32a2b85c7d92ece86c17dfef390c5ed79c6378 (git)
Affected: 8fccebfa534c7984864394fa03608305e4929aae , < 0e309e1152fc34ef75991d9d69b165dbf75bf26c (git)
Affected: 8fccebfa534c7984864394fa03608305e4929aae , < 4afb912f439c4bc4e6a4f3e7547f2e69e354108f (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.75 , ≤ 5.10.* (semver)
Unaffected: 5.14.14 , ≤ 5.14.* (semver)
Unaffected: 5.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47433",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-10T18:56:43.265826Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-10T18:57:31.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e32a2b85c7d92ece86c17dfef390c5ed79c6378",
              "status": "affected",
              "version": "8fccebfa534c7984864394fa03608305e4929aae",
              "versionType": "git"
            },
            {
              "lessThan": "0e309e1152fc34ef75991d9d69b165dbf75bf26c",
              "status": "affected",
              "version": "8fccebfa534c7984864394fa03608305e4929aae",
              "versionType": "git"
            },
            {
              "lessThan": "4afb912f439c4bc4e6a4f3e7547f2e69e354108f",
              "status": "affected",
              "version": "8fccebfa534c7984864394fa03608305e4929aae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.75",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.14",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix abort logic in btrfs_replace_file_extents\n\nError injection testing uncovered a case where we\u0027d end up with a\ncorrupt file system with a missing extent in the middle of a file.  This\noccurs because the if statement to decide if we should abort is wrong.\n\nThe only way we would abort in this case is if we got a ret !=\n-EOPNOTSUPP and we called from the file clone code.  However the\nprealloc code uses this path too.  Instead we need to abort if there is\nan error, and the only error we _don\u0027t_ abort on is -EOPNOTSUPP and only\nif we came from the clone file code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable prealloc path is reachable remotely via NFSv4 ALLOCATE (nfsd4_allocate \u2192 vfs_fallocate \u2192 btrfs_fallocate \u2192 insert_prealloc_file_extent \u2192 btrfs_replace_file_extents) when nfsd exports a btrfs filesystem, a common server deployment.\nAC:L - An attacker who can issue fallocate/ALLOCATE against a writable btrfs file drives the vulnerable path directly; inducing a mid-drop failure (for example via memory/metadata pressure) does not require a race or other condition outside the attacker\u2019s influence.\nPR:L - Exploitation needs only write access to a regular file on btrfs (local fallocate or an NFS write stateid); root or init-namespace capabilities are not required.\nUI:N - No victim action is needed beyond the already-mounted/exported btrfs filesystem; the attacker triggers the bug solely through fallocate/ALLOCATE.\nS:U - Impact is confined to the host kernel\u2019s btrfs instance (on-disk corruption / filesystem disruption) and does not cross a VM, IOMMU, or other security authority boundary.\nC:N - The bug leaves missing file extent items (holes/data loss), not an out-of-bounds or UAF read primitive, so it does not disclose arbitrary kernel or other users\u2019 data.\nI:H - On error after extents are dropped, the transaction is not aborted and can commit, producing durable filesystem corruption with missing extents in the middle of a file, which is a high integrity impact on stored data and FS metadata.\nA:H - Committed missing-extent corruption can break subsequent reads/FS operations and destabilize the shared filesystem for all users of that volume, constituting a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:47.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f"
        }
      ],
      "title": "btrfs: fix abort logic in btrfs_replace_file_extents",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47433",
    "datePublished": "2024-05-22T06:19:30.244Z",
    "dateReserved": "2024-05-21T14:58:30.830Z",
    "dateUpdated": "2026-08-05T08:47:47.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47433",
      "date": "2026-09-14",
      "epss": "0.00575",
      "percentile": "0.4568"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix abort logic in btrfs_replace_file_extents\\n\\nError injection testing uncovered a case where we\u0027d end up with a\\ncorrupt file system with a missing extent in the middle of a file.  This\\noccurs because the if statement to decide if we should abort is wrong.\\n\\nThe only way we would abort in this case is if we got a ret !=\\n-EOPNOTSUPP and we called from the file clone code.  However the\\nprealloc code uses this path too.  Instead we need to abort if there is\\nan error, and the only error we _don\u0027t_ abort on is -EOPNOTSUPP and only\\nif we came from the clone file code.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: btrfs: corrige la l\\u00f3gica de aborto en btrfs_replace_file_extents Las pruebas de inyecci\\u00f3n de errores descubrieron un caso en el que terminar\\u00edamos con un sistema de archivos corrupto al que le faltaba una extensi\\u00f3n en medio de un archivo. Esto ocurre porque la declaraci\\u00f3n if para decidir si debemos abortar es incorrecta. La \\u00fanica manera de abortar en este caso es si obtenemos un ret! = -EOPNOTSUPP y llamamos desde el c\\u00f3digo de clonaci\\u00f3n del archivo. Sin embargo, el c\\u00f3digo de preasignaci\\u00f3n tambi\\u00e9n utiliza esta ruta. En lugar de eso, debemos abortar si hay un error, y el \\u00fanico error por el que _no_ abortamos es -EOPNOTSUPP y solo si venimos del c\\u00f3digo del archivo clonado.\"}]",
      "id": "CVE-2021-47433",
      "lastModified": "2024-11-21T06:36:08.040",
      "published": "2024-05-22T07:15:08.347",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47433\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-22T07:15:08.347\",\"lastModified\":\"2026-08-04T10:17:03.140\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix abort logic in btrfs_replace_file_extents\\n\\nError injection testing uncovered a case where we\u0027d end up with a\\ncorrupt file system with a missing extent in the middle of a file.  This\\noccurs because the if statement to decide if we should abort is wrong.\\n\\nThe only way we would abort in this case is if we got a ret !=\\n-EOPNOTSUPP and we called from the file clone code.  However the\\nprealloc code uses this path too.  Instead we need to abort if there is\\nan error, and the only error we _don\u0027t_ abort on is -EOPNOTSUPP and only\\nif we came from the clone file code.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: btrfs: corrige la l\u00f3gica de aborto en btrfs_replace_file_extents Las pruebas de inyecci\u00f3n de errores descubrieron un caso en el que terminar\u00edamos con un sistema de archivos corrupto al que le faltaba una extensi\u00f3n en medio de un archivo. Esto ocurre porque la declaraci\u00f3n if para decidir si debemos abortar es incorrecta. La \u00fanica manera de abortar en este caso es si obtenemos un ret! = -EOPNOTSUPP y llamamos desde el c\u00f3digo de clonaci\u00f3n del archivo. Sin embargo, el c\u00f3digo de preasignaci\u00f3n tambi\u00e9n utiliza esta ruta. En lugar de eso, debemos abortar si hay un error, y el \u00fanico error por el que _no_ abortamos es -EOPNOTSUPP y solo si venimos del c\u00f3digo del archivo clonado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8fccebfa534c7984864394fa03608305e4929aae\",\"lessThan\":\"0e32a2b85c7d92ece86c17dfef390c5ed79c6378\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8fccebfa534c7984864394fa03608305e4929aae\",\"lessThan\":\"0e309e1152fc34ef75991d9d69b165dbf75bf26c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8fccebfa534c7984864394fa03608305e4929aae\",\"lessThan\":\"4afb912f439c4bc4e6a4f3e7547f2e69e354108f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.75\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14.14\",\"lessThanOrEqual\":\"5.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-10T18:56:43.265826Z\",\"id\":\"CVE-2021-47433\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.75\",\"matchCriteriaId\":\"271284AE-D4B8-4931-A945-91F5B7D00C32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.14.14\",\"matchCriteriaId\":\"BF43A331-D430-4B9D-A612-E63C62AE4A86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E46C74C6-B76B-4C94-A6A4-FD2FFF62D644\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"60134C3A-06E4-48C1-B04F-2903732A4E56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0460DA88-8FE1-46A2-9DDA-1F1ABA552E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF55383D-4DF2-45DC-93F7-571F4F978EAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:56:01+00:00",
      "cve": "CVE-2021-47433",
      "id": "CVE-2021-47433",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix abort logic in btrfs_replace_file_extents",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47433.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-13T23:55:43Z",
      "cve": "CVE-2021-47433",
      "id": "CVE-2021-47433",
      "initial_release_date": "2024-05-28T03:33:46Z",
      "product_status:known_affected": "344",
      "product_status:known_not_affected": "182",
      "product_status:recommended": "452",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47433",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47433.json",
      "version": "68"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:39:59.455Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47433\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-10T18:56:43.265826Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-10T18:57:27.813Z\"}}], \"cna\": {\"title\": \"btrfs: fix abort logic in btrfs_replace_file_extents\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable prealloc path is reachable remotely via NFSv4 ALLOCATE (nfsd4_allocate \\u2192 vfs_fallocate \\u2192 btrfs_fallocate \\u2192 insert_prealloc_file_extent \\u2192 btrfs_replace_file_extents) when nfsd exports a btrfs filesystem, a common server deployment.\\nAC:L - An attacker who can issue fallocate/ALLOCATE against a writable btrfs file drives the vulnerable path directly; inducing a mid-drop failure (for example via memory/metadata pressure) does not require a race or other condition outside the attacker\\u2019s influence.\\nPR:L - Exploitation needs only write access to a regular file on btrfs (local fallocate or an NFS write stateid); root or init-namespace capabilities are not required.\\nUI:N - No victim action is needed beyond the already-mounted/exported btrfs filesystem; the attacker triggers the bug solely through fallocate/ALLOCATE.\\nS:U - Impact is confined to the host kernel\\u2019s btrfs instance (on-disk corruption / filesystem disruption) and does not cross a VM, IOMMU, or other security authority boundary.\\nC:N - The bug leaves missing file extent items (holes/data loss), not an out-of-bounds or UAF read primitive, so it does not disclose arbitrary kernel or other users\\u2019 data.\\nI:H - On error after extents are dropped, the transaction is not aborted and can commit, producing durable filesystem corruption with missing extents in the middle of a file, which is a high integrity impact on stored data and FS metadata.\\nA:H - Committed missing-extent corruption can break subsequent reads/FS operations and destabilize the shared filesystem for all users of that volume, constituting a high availability impact.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8fccebfa534c7984864394fa03608305e4929aae\", \"lessThan\": \"0e32a2b85c7d92ece86c17dfef390c5ed79c6378\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8fccebfa534c7984864394fa03608305e4929aae\", \"lessThan\": \"0e309e1152fc34ef75991d9d69b165dbf75bf26c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8fccebfa534c7984864394fa03608305e4929aae\", \"lessThan\": \"4afb912f439c4bc4e6a4f3e7547f2e69e354108f\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.75\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.14.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0e32a2b85c7d92ece86c17dfef390c5ed79c6378\"}, {\"url\": \"https://git.kernel.org/stable/c/0e309e1152fc34ef75991d9d69b165dbf75bf26c\"}, {\"url\": \"https://git.kernel.org/stable/c/4afb912f439c4bc4e6a4f3e7547f2e69e354108f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix abort logic in btrfs_replace_file_extents\\n\\nError injection testing uncovered a case where we\u0027d end up with a\\ncorrupt file system with a missing extent in the middle of a file.  This\\noccurs because the if statement to decide if we should abort is wrong.\\n\\nThe only way we would abort in this case is if we got a ret !=\\n-EOPNOTSUPP and we called from the file clone code.  However the\\nprealloc code uses this path too.  Instead we need to abort if there is\\nan error, and the only error we _don\u0027t_ abort on is -EOPNOTSUPP and only\\nif we came from the clone file code.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.75\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14.14\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:47.653Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47433\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:47.653Z\", \"dateReserved\": \"2024-05-21T14:58:30.830Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-22T06:19:30.244Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.